ccea14ac47
What's left enabled: * Access to /dev -- obviously * CAP_SYS_ADMIN -- this is needed by TIOCSSERIAL only. Too bad this also allows TIOCSTI, which allows for code injection unless something else (SELinux) disallows access to ttys with shells. Maybe kernel should use CAP_SYS_TTY_CONFIG for this. * socket(AF_NETLINK) -- udev & kernel device changes * socket(AF_UNIX) -- D-Bus
21 lines
420 B
SYSTEMD
21 lines
420 B
SYSTEMD
[Unit]
|
|
Description=Modem Manager
|
|
After=syslog.target
|
|
|
|
[Service]
|
|
Type=dbus
|
|
BusName=org.freedesktop.ModemManager1
|
|
ExecStart=@sbindir@/ModemManager
|
|
StandardError=null
|
|
Restart=on-abort
|
|
CapabilityBoundingSet=CAP_SYS_ADMIN
|
|
ProtectSystem=true
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
RestrictAddressFamilies=AF_NETLINK AF_UNIX
|
|
NoNewPrivileges=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
Alias=dbus-org.freedesktop.ModemManager1.service
|